Pier Angelo Vendrame pushed to branch tor-browser-153.0a1-16.0-1 at The Tor Project / Applications / Tor Browser Commits: 5d6c80ab by Pier Angelo Vendrame at 2026-06-29T15:03:39+02:00 fixup! Firefox preference overrides. BB 45072: Disable XSLT. XSLT eventually is going to be disabled in all major browsers. While Mozilla has not started the process yet, it makes sense for us to do it, since XSLT has been a source of security bugs and fingerprinting vectors in the past. - - - - - 1 changed file: - browser/app/profile/001-base-profile.js Changes: ===================================== browser/app/profile/001-base-profile.js ===================================== @@ -476,6 +476,9 @@ pref("dom.push.enabled", false); // See tor-browser#18801. pref("dom.push.serverURL", ""); +// tor-browser#45072: Disable XSLT even before Mozilla does it for Firefox. +pref("dom.xslt.enabled", false); + // Fingerprinting // tor-browser#41797: For release builds, lock RFP // tor-browser#42125: Set (and lock in release) also exempted domains. View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/5d6c80ab... -- View it on GitLab: https://gitlab.torproject.org/tpo/applications/tor-browser/-/commit/5d6c80ab... You're receiving this email because of your account on gitlab.torproject.org. Manage all notifications: https://gitlab.torproject.org/-/profile/notifications | Help: https://gitlab.torproject.org/help